Executive brief
BoidCMS, a lightweight website management system, is vulnerable to a security flaw that allows an administrator to take full control of the underlying web server. By uploading a specially crafted image file containing hidden code and then manipulating page settings, an attacker can force the server to execute that code. This can lead to the theft of sensitive data, website defacement, or a complete shutdown of the service.
Technical details
BoidCMS versions prior to 2.1.3 contain a Local File Inclusion (LFI) vulnerability in the 'tpl' (template) parameter during page creation and updates. The application fails to sanitize this parameter before passing it to a PHP require_once() statement in the render() method of app/app.php. An authenticated administrator can use path traversal sequences (../) to escape the themes directory and include arbitrary files. By first uploading a malicious PHP payload disguised as an image via the media manager and then referencing it through the tpl parameter, an attacker can achieve Remote Code Execution (RCE) with the privileges of the web server. This issue is fixed in version 2.1.3.
Affected products
- BoidCMS BoidCMS < 2.1.3
Timeline
- 2026-04-12: patched: Version 2.1.3 released to address the vulnerability.
- 2026-04-13: advisory: GitHub Security Advisory GHSA-45xp-xw54-6cv6 published.
- 2026-04-14: disclosed: CVE-2026-39387 published.